MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a
SHA3-384 hash: 402a19fb95aad2a6840cc9fc457c214a158acf54644bc068653d51f9f0132b669e432fe0726e80eb913a7027e3d3753d
SHA1 hash: 35faf365ab0a99ca884c8a8c6138882cbdef0a1d
MD5 hash: 19503c594ddfdf38c0c7e059aaf624cf
humanhash: berlin-uniform-iowa-uranus
File name:19503c594ddfdf38c0c7e059aaf624cf.exe
Download: download sample
File size:293'888 bytes
First seen:2023-03-04 16:07:50 UTC
Last seen:2023-03-04 17:28:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0d1c7c17a5c1778f16fd872183052036
ssdeep 6144:x8zp5MxVCSCyXcgjSEKnQnpTKQ3u03ao3vFv:Szp5MxNdcgjSbQnpTyUao39
Threatray 1'391 similar samples on MalwareBazaar
TLSH T132549D227798D033D59316308E279B77DABDB8712D214447BBC41A2DAE70AD1FE3871A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
19503c594ddfdf38c0c7e059aaf624cf.exe
Verdict:
No threats detected
Analysis date:
2023-03-04 16:08:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d16b96ce-80e6-4cfe-8f58-dc4fcca13ecb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371638/
Detection(s):
SecuriteInfo.com.Variant.Johnnie.257677.26081.23483.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd.exe explorer.exe greyware ransomware shell32.dll zpevdo
Link:
https://www.filescan.io/uploads/64036ce3bfec0852a68f1971/reports/b9162397-79c3-4708-a6c7-c8b679926631/overview
Verdict:
Malicious
Labled as:
Johnnie.Generic
Link:
https://www.hybrid-analysis.com/sample/9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2d07a22c-30b9-43c7-a15e-f63303a4c7b6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1187154
Signature
Contains functionality to detect sleep reduction / modifications
Delayed program exit found
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a/
Threat name:
Win32.Trojan.Johnnie
Create hunting rule
Status:
Malicious
First seen:
2018-10-10 02:39:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
17 of 39 (43.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tkosu2n4yu7bphooydfyu3gzqa7wmdsjmyu4j47d7ig7wpfz7b5a._file
Verdict:
malicious
Similar samples:
3a573796b5e6f1cc3a92eef7e268fa4e74aeddf34f5dd62f7b02109fe560ecd2
4ecf088b72ad757838854c995b978ba8e146e5e1c62720b18736741b1d6c6418
5455441cf085fe5e5c605e6870fadd4f47f215d4525e23f5b75eaabec8cf3705
8a59fe8ca31ce4abde54d02705f65ed0d788e384e0d5c05441971f4d1fef5b34
a484a486e4ccce5d89bed7fd21d3aef4802a85b3147a0445ccca16b3df95267a
b4bbdadeb876d22140beabe77e143cd74871461c0823f9f9ba79b41106386d26
b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1
d093cc2e257699ebf02497e30b6c5590ef100f44a7d692d2cac83f0a813985b5
da9a898aeba9ed3dbf4d70fd12a8c886e1a7952c9bcb05952f87d9113c9df84b
dc0d7e5dcd6f5cc175ab3d6173220fb483570c8b1b81cc2ab68c95407368240e
+ 1'381 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230304-tk7s3sdf7w/
Unpacked files
SH256 hash:
9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a
MD5 hash:
19503c594ddfdf38c0c7e059aaf624cf
SHA1 hash:
35faf365ab0a99ca884c8a8c6138882cbdef0a1d
Link:
https://www.unpac.me/results/f3115518-4b94-4071-a9fb-7200998998ed/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/371638/

Comments